Bug#873557: mbedtls: possible authentication bypass

2017-08-30 Thread Salvatore Bonaccorso
Control: retitle mbedtls: CVE-2017-14032: authentication bypass Hi On Tue, Aug 29, 2017 at 12:09:30AM +0100, James Cowgill wrote: > Source: mbedtls > Version: 2.1.2-1 > Severity: grave > Tags: security > > Hi, > > The following security advisory was published for mbedtls: > https://tls.mbed.org

Bug#873557: mbedtls: possible authentication bypass

2017-08-29 Thread James Cowgill
On 29/08/17 00:09, James Cowgill wrote: > I think this is the commit which fixes this, but I have not checked yet: > https://github.com/ARMmbed/mbedtls/commit/31458a18788b0cf0b722acda9bb2f2fe13a3fb32 In addition, this commit must be applied before that one: https://github.com/ARMmbed/mbedtls/commi

Bug#873557: mbedtls: possible authentication bypass

2017-08-28 Thread James Cowgill
Source: mbedtls Version: 2.1.2-1 Severity: grave Tags: security Hi, The following security advisory was published for mbedtls: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2017-02 [Vulnerability] If a malicious peer supplies an X.509 certificate chain that has